7143 matches found
CVE-2026-71870
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...
MAL-2026-13628 Malicious code in streak-map-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...
Malicious code in streak-map-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...
MAL-2026-13678 Malicious code in svelte-map-visual (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...
Malicious code in svelte-map-visual (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...
Malicious code in streak-kit-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...
SUSE CVE-2026-64590
In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...
Malicious code in svelte-visual-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b68e25df054313067ca459b865ea19afd38a9c4b8c90a02a6f56bd4475cf6f No a static rule matches and no traced behaviors of concern were identified in this package version. The tarball does not exhibit lifecycle-script...
MAL-2026-13477 Malicious code in svelte-visual-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b68e25df054313067ca459b865ea19afd38a9c4b8c90a02a6f56bd4475cf6f No a static rule matches and no traced behaviors of concern were identified in this package version. The tarball does not exhibit lifecycle-script...
Malicious code in streak-map-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...
MAL-2026-13459 Malicious code in streak-map-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...
libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...
libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC Scalable Video Coding layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer contex...
CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...
EUVD-2026-53860
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
CVE-2026-64582
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...
CVE-2026-64582 RDMA/rxe: Fix a use-after-free problem in rxe_mmap
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...
CVE-2026-18322 Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the havePermissions function in classes/frame.php, where arraymerge overwrites the popup module's...
